Sessions expire when users log in after update Joomla 1.5.17

[nguyenkhanhhung]

I have a session. This session keeps items of the shopping cart. When the users log in to checkout, all items of the shopping cart was removed. This doesn't happen when I use the version 1.5.15. This happens when i upgrade to version 1.5.17

Please help to check this.

[ianmac]

What shopping cart is it?

Is it native to Joomla or is it trying to peak at the session data? Code was introduced in 1.5.16 to deal with issues with session fixation. If third party scripts are trying to grab data based on a session id that will need to be updated to accommodate this.

Ian

[nguyenkhanhhung]

Yes, it is native to Joomla
Here is the code:

Code: Select all

class EPGUtilities
{
    function getSessionObject($name = '', $classname = 'JObject')
    {
        $session = JFactory::getSession();
        $object = $session->get($name);
        if($object)
        {
            $object = unserialize($object);
        }

        if($object == null ||$object->session_id == null || $object->session_id != $session->getId())
        {
            $object = new $classname();
            $object->session_id = $session->getId();

            EPGUtilities::setSessionObject($name, $object);
        }
        
        return $object;
    }
    
    function setSessionObject($name = '', $object = '')
    {
        $session = JFactory::getSession();
        if($object)
        {
            $session->set($name, serialize($object));
        }
        else
        {
            $session->clear($name);
        }
    }
}

[ianmac]

Yes, it is native to Joomla
Here is the code:

Code: Select all

class EPGUtilities
{
    function getSessionObject($name = '', $classname = 'JObject')
    {
        $session = JFactory::getSession();
        $object = $session->get($name);
        if($object)
        {
            $object = unserialize($object);
        }

        if($object == null ||$object->session_id == null || $object->session_id != $session->getId())
        {
            $object = new $classname();
            $object->session_id = $session->getId();

            EPGUtilities::setSessionObject($name, $object);
        }
        
        return $object;
    }
    
    function setSessionObject($name = '', $object = '')
    {
        $session = JFactory::getSession();
        if($object)
        {
            $session->set($name, serialize($object));
        }
        else
        {
            $session->clear($name);
        }
    }
}

This code here:
if($object == null ||$object->session_id == null || $object->session_id != $session->getId())

Seems to check if the session ID of the Joomla! session matches the session id in your stored object. If it doesn't it throws out your data.

Joomla's session ID changes on login for security reasons.

Your code will have to be adapted to accomodate this.

Ian